After reading the section "Formula for endpoint data recorder data storage size" in the Symantec Advanced Threat Protection 3.2 Sizing and Scalability Guide, you have questions about the formula itself or the numbers cited.

Resolution:

Q: When calculating, e is "Dump size... This number is the amount of disk space that you allocated on the endpoint". Are dumps that are cancelled or failed included in this number?A: Yes, when calculating these estimates, assume that each dump succeeds.

Q: When calculating, c is "Number of days = 30". Is the number of days fixed in ATP or configurable?
A: Fixed at 30 days

Q: When using these formulae, b is the number representing "Endpoint data recorder size per endpoint per day". How is this determined?
A: These numbers originated from research done previously by the Engineering team on sizing: